Re: pg_hba, access control for a webserver, superuser, and joe user

On Tue, Jan 28, 2003 at 15:39:03 -0800,
Jerry Asher <jerry(dot)nospam(at)theashergroup(dot)com> wrote:
>
> Does the order of statements in pg_hba.conf matter?
> Is there a priority and a fallback of sorts? Try this first mechanism
> and if that fails, try the next mechanism?

Yes the order matters. Only the first rule that matches is used to
do the authentication. If it fails no other rules are tried.

For your kind of set up, you want to do the user specific rules first
(postgres and the web user) followed by the wildcard rule for users
connecting to a matching database.

Here is a sample that I use that is similar to what you are trying to do.

HBA:
local all postgres ident postgres
local area,book,cube,template1 bruno ident sameuser
local area,book nobody ident nobody
local sameuser all ident sameuser

IDENT:
postgres root postgres
postgres bruno postgres
postgres postgres postgres
nobody bruno nobody
nobody nobody nobody